List API keys

List the caller's API keys for the current org.

Returns only the masked key_prefix, never the full key. Cursor-paginated via limit / cursor query params.

The cursor is decoded eagerly so a malformed cursor surfaces a 422 bad_cursor before the database is touched. The cursor window is then applied in memory (matching :mod:app.api_public.agents): list_keys orders by created_at.desc(), so we decode the cursor, drop rows up to and including the cursor id, and let build_cursor_from_rows split the page + next cursor. When no cursor is supplied we fetch limit + 1 so the page builder can detect a next page.